$_SESSION, Logout, and Shared Host

[Christopher R. Merlo]

Hi.  I recently migrated my web app from my personal server to a (*way* more powerful) shared server, where one of my colleagues also hosts his app.  Both were written in PHP.  Due to neither one of us having run into this before, if you are logged in to both apps at the same time from the same browser (which happens; we share more than a few students in common), and log out of one, you get logged out of the other.  In my code, the logout routine is as follows:

foreach( $_SESSION as $key=>$value ) {
    unset( $_SESSION[ $key ] );
}

And his code is essentially the same (I think he might use a session_destroy() or something).

I know that if I add a layer to $_SESSION, like creating $_SESSION[ 'my_app' ][ keys... ], and then only unset those upon logout, I will prevent my students from logging out of any app other than my own.  But that's a lot of code to change (not the logout code, that's easy; but all the places I check to see if someone's logged in) and besides, I imagine there has to be a better way.

Please pretend that using a different physical or virtual server is not possible, because it's essentially not (yay county budget!), so: what's the PHP way to solve this problem?  Is there some way we can namespace-ize our $_SESSION variables or something?

Thanks,
-Chris

_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation

[Tim Lieberman-2]

It sounds like both applications are running on the same domain.  If  
that's not the case, something else is going on.

You have a couple of options, none of which might make you happy.

1) In your app, use a custom session name (session_name('MYSESSID')  
before you call session_start()).  You'll probably want to create a  
directory that the webserver can write to, and set session_save_path.

This should work nicely, unless you need to share session data with  
your colleage's appication.

If you do need both apps to access some shared session data,  you're  
stuck changing a bunch of references in code.  However, a global find/
replace to replace $_SESSION with $_SESSION['someKey'] will probably  
do the trick, and not be too painful.

Good luck.

-Tim



On Nov 4, 2009, at 6:54 PM, Christopher R. Merlo wrote:

> Hi.  I recently migrated my web app from my personal server to a  
> (*way* more powerful) shared server, where one of my colleagues also  
> hosts his app.  Both were written in PHP.  Due to neither one of us  
> having run into this before, if you are logged in to both apps at  
> the same time from the same browser (which happens; we share more  
> than a few students in common), and log out of one, you get logged  
> out of the other.  In my code, the logout routine is as follows:
>
> foreach( $_SESSION as $key=>$value ) {
>     unset( $_SESSION[ $key ] );
> }
>
> And his code is essentially the same (I think he might use a  
> session_destroy() or something).
>
> I know that if I add a layer to $_SESSION, like creating  
> $_SESSION[ 'my_app' ][ keys... ], and then only unset those upon  
> logout, I will prevent my students from logging out of any app other  
> than my own.  But that's a lot of code to change (not the logout  
> code, that's easy; but all the places I check to see if someone's  
> logged in) and besides, I imagine there has to be a better way.
>
> Please pretend that using a different physical or virtual server is  
> not possible, because it's essentially not (yay county budget!), so:  
> what's the PHP way to solve this problem?  Is there some way we can  
> namespace-ize our $_SESSION variables or something?
>
> Thanks,
> -Chris
> _______________________________________________
> New York PHP Users Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/Show-Participation

_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation

[Christopher R. Merlo]

On Wed, Nov 4, 2009 at 8:16 PM, Tim Lieberman <tim_lists@...> wrote:

It sounds like both applications are running on the same domain.  If that's not the case, something else is going on.

They are running on the same domain.
 

You have a couple of options, none of which might make you happy.

1) In your app, use a custom session name (session_name('MYSESSID') before you call session_start()).

Judging from the errors I got, it seems like I may have to do that before *every* call to session_start(), which is Big Oh of the amount of work in adding a layer to $_SESSION.
 

This should work nicely, unless you need to share session data with your colleage's appication.

No, we need to not share data with each other -- if you're submitting assignments in ITE 101, you don't want to accidentally overwrite what you already submitted for CSC 101, for example.
 

However, a global find/replace to replace $_SESSION with $_SESSION['someKey'] will probably do the trick, and not be too painful.

Yeah, I can do that with find, xargs, and sed.  Thanks for the advice.
-c

_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation

[Ben Sgro (ProjectSkyline)]

Hello,

I'm pretty sure you can control the /tmp/ directory where the sessions
are stored. Just change it to be relative for each application.
http://www.php.net/manual/en/function.session-save-path.php

- Ben

Christopher R. Merlo wrote:

> On Wed, Nov 4, 2009 at 8:16 PM, Tim Lieberman <tim_lists@...
> <mailto:tim_lists@...>> wrote:
>
>     It sounds like both applications are running on the same domain.
>      If that's not the case, something else is going on.
>
>
> They are running on the same domain.
>  
>
>     You have a couple of options, none of which might make you happy.
>
>     1) In your app, use a custom session name
>     (session_name('MYSESSID') before you call session_start()).
>
>
> Judging from the errors I got, it seems like I may have to do that
> before *every* call to session_start(), which is Big Oh of the amount
> of work in adding a layer to $_SESSION.
>  
>
>     This should work nicely, unless you need to share session data
>     with your colleage's appication.
>
>
> No, we need to not share data with each other -- if you're submitting
> assignments in ITE 101, you don't want to accidentally overwrite what
> you already submitted for CSC 101, for example.
>  
>
>     However, a global find/replace to replace $_SESSION with
>     $_SESSION['someKey'] will probably do the trick, and not be too
>     painful.
>
>
> Yeah, I can do that with find, xargs, and sed.  Thanks for the advice.
> -c
> ------------------------------------------------------------------------
>
> _______________________________________________
> New York PHP Users Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/Show-Participation

_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation

[Tim Lieberman-2]

On Nov 4, 2009, at 9:19 PM, Christopher R. Merlo wrote:
> Judging from the errors I got, it seems like I may have to do that  
> before *every* call to session_start(), which is Big Oh of the  
> amount of work in adding a layer to $_SESSION.

True.  You've just learned a valuable lesson: You should only ever  
call session_start() in one place.  Typically, people it put it some  
file named something like "config.php", that gets included by every  
other page in the application.

>
> This should work nicely, unless you need to share session data with  
> your colleage's appication.
>
> No, we need to not share data with each other -- if you're  
> submitting assignments in ITE 101, you don't want to accidentally  
> overwrite what you already submitted for CSC 101, for example.

True enough.

>
> However, a global find/replace to replace $_SESSION with  
> $_SESSION['someKey'] will probably do the trick, and not be too  
> painful.
>
> Yeah, I can do that with find, xargs, and sed.  Thanks for the advice.

That's probably how I would do it.

I suggest you do *both*.  If you're repeating configuration stuff  
(session_start()) all over the place, you should be refactoring anyway.

Doing some fake namespacing in $_SESSION is a good idea, too.

I'd do both, but I'd refactor all of your configuration/bootstrapping  
first.
_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation

[Ron Guerin]

Christopher R. Merlo wrote:

> On Wed, Nov 4, 2009 at 8:16 PM, Tim Lieberman <tim_lists@...
> <mailto:tim_lists@...>> wrote:
>
>     It sounds like both applications are running on the same domain.
>      If that's not the case, something else is going on.
>
>
> They are running on the same domain.
>  
>
>     You have a couple of options, none of which might make you happy.
>
>     1) In your app, use a custom session name
>     (session_name('MYSESSID') before you call session_start()).
>
>
> Judging from the errors I got, it seems like I may have to do that
> before *every* call to session_start(), which is Big Oh of the amount
> of work in adding a layer to $_SESSION.
>  

>
>  
>
>     However, a global find/replace to replace $_SESSION with
>     $_SESSION['someKey'] will probably do the trick, and not be too
>     painful.
>
>
> Yeah, I can do that with find, xargs, and sed.  Thanks for the advice.

You could also use those tools to replace "session_start();" with
"session_name('whatever'); session_start();"

- Ron
_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation

[Christopher R. Merlo]

On Wed, Nov 4, 2009 at 9:49 PM, Tim Lieberman <tim_lists@...> wrote:

True.  You've just learned a valuable lesson: You should only ever call session_start() in one place.

It's funny; that just occurred to me as I was about to read your response.  "Why on earth," I started saying to myself, "would I have called this from multiple places?"  Sure enough, my login.php script does exactly that.  What I should really be doing is starting the session in one place (I call it _header.inc), which I already include from every other script -- except a couple of really old ones, like login.php, which I was too lazy to rewrite when I re-engineered this project with PHP 5 compliance, jQuery, etc.

So, pilot error.  :)
 

I suggest you do *both*.  If you're repeating configuration stuff (session_start()) all over the place, you should be refactoring anyway.

Doing some fake namespacing in $_SESSION is a good idea, too.

I'd do both, but I'd refactor all of your configuration/bootstrapping first.

That's exactly what I'm going to do.  I also started thinking about when I roll this software out for other faculty to use; each instance should be creating its own session variables.

Anyway, thanks Tim and list for helping me find my mistake.
-c

_______________________________________________
New York PHP Users Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/Show-Participation